switchroom 0.18.12 → 0.18.14

package/telegram-plugin/outbound-field-redact.ts

@@ -0,0 +1,69 @@
+/**
+ * Structured-payload outbound redaction (#2044 coverage extension).
+ *
+ * The original #2044 outbound scrub masks agent-authored FREE TEXT on the
+ * reply / edit_message / progress_update paths (see gateway.ts
+ * `redactOutboundText`). But several other outbound surfaces carry
+ * agent-authored text to Telegram inside STRUCTURED payloads and had no
+ * redaction at all:
+ *
+ *   - ask_user      → the question text + every option/button label
+ *   - send_checklist / update_checklist → the title + every task's text
+ *
+ * An agent that echoes a token or a DATABASE_URL it just read into an
+ * ask_user question, a button label, or a checklist task would transmit it
+ * unmasked — defeating the same scrub invariant the reply `text` path
+ * honors.
+ *
+ * These helpers apply the SAME redactor to each such field. The redactor is
+ * INJECTED (the gateway passes its `redactOutboundText`; tests pass the real
+ * `redact`) so the masking is deterministic and unit-testable at the OUTCOME
+ * level: the object returned here is exactly what the downstream send call
+ * receives, so a test can assert the secret is gone from the sent payload —
+ * not merely that a redactor was invoked.
+ */
+
+/** A pure text redactor: maps input text to a masked copy. */
+export type FieldRedactor = (text: string) => string
+
+/**
+ * Redact the two agent-authored outbound fields of an ask_user prompt: the
+ * question and each option label. Returns fresh values (the input arrays are
+ * not mutated) so the caller can assign them onto the validated args.
+ */
+export function redactAskUserFields(
+  question: string,
+  options: readonly string[],
+  redact: FieldRedactor,
+): { question: string; options: string[] } {
+  return {
+    question: redact(question),
+    options: options.map((opt) => redact(opt)),
+  }
+}
+
+/** Minimal shape of a checklist task — only `text` is redacted; every other
+ *  field (id, done, …) is carried through untouched. */
+export interface ChecklistTaskLike {
+  text?: string
+  [key: string]: unknown
+}
+
+/**
+ * Redact the agent-authored outbound fields of a checklist: the title and
+ * each task's `text`. `title`/`tasks` may be undefined (update_checklist
+ * allows partial patches); undefined passes through untouched. A task whose
+ * `text` is undefined (an id-only patch) is left as-is.
+ */
+export function redactChecklistFields<T extends ChecklistTaskLike>(
+  title: string | undefined,
+  tasks: readonly T[] | undefined,
+  redact: FieldRedactor,
+): { title: string | undefined; tasks: T[] | undefined } {
+  return {
+    title: title != null ? redact(title) : title,
+    tasks: tasks?.map((task) =>
+      task.text != null ? { ...task, text: redact(task.text) } : task,
+    ),
+  }
+}

package/telegram-plugin/render/render.ts

@@ -30,7 +30,7 @@
 // equivalent entities rather than accidentally re-triggering formatting or
 // breaking out of a code span.
 
-import { escapeMarkdown, codeSpanSafe, RICH_MESSAGE_MAX_CHARS } from "../format.js";
+import { escapeMarkdown, codeSpanSafe, escapeLinkHref, RICH_MESSAGE_MAX_CHARS } from "../format.js";
 import type {
   Block,
   BlockquoteNode,
@@ -47,26 +47,44 @@ import type {
 // Inline rendering
 // ---------------------------------------------------------------------------
 
-function renderInline(node: Inline): string {
+/** Rendering context threaded through the inline walk. `inTableCell` is set
+ *  while rendering the inline content of a GFM table cell, where a literal `|`
+ *  — even inside an inline-code span — would be read as a column separator and
+ *  tear the row (F4). Plain-text `|` is already neutralised by `escapeMarkdown`
+ *  (`|` is one of its specials); the only gap is the code span, whose content
+ *  is otherwise verbatim, so we backslash-escape `|` there in the table
+ *  context. GFM strips the `\` and keeps the pipe literal inside the span. */
+interface InlineCtx {
+  inTableCell?: boolean;
+}
+
+function renderInline(node: Inline, ctx: InlineCtx = {}): string {
   switch (node.type) {
     case "plain":
       return escapeMarkdown(node.text);
     case "bold":
-      return `**${renderInlineChildren(node.children)}**`;
+      return `**${renderInlineChildren(node.children, ctx)}**`;
     case "italic":
-      return `*${renderInlineChildren(node.children)}*`;
+      return `*${renderInlineChildren(node.children, ctx)}*`;
     case "underline":
-      return `__${renderInlineChildren(node.children)}__`;
+      return `__${renderInlineChildren(node.children, ctx)}__`;
     case "strike":
-      return `~~${renderInlineChildren(node.children)}~~`;
+      return `~~${renderInlineChildren(node.children, ctx)}~~`;
     case "spoiler":
-      return `||${renderInlineChildren(node.children)}||`;
+      return `||${renderInlineChildren(node.children, ctx)}||`;
     case "highlight":
-      return `==${renderInlineChildren(node.children)}==`;
-    case "code":
-      return `\`${codeSpanSafe(node.text)}\``;
+      return `==${renderInlineChildren(node.children, ctx)}==`;
+    case "code": {
+      const safe = codeSpanSafe(node.text);
+      // In a table cell, an unescaped `|` inside the span closes the cell early
+      // and corrupts the row; `\|` survives (GFM keeps the pipe literal in the
+      // span and drops the backslash). Elsewhere the span content is verbatim.
+      return `\`${ctx.inTableCell ? safe.replace(/\|/g, "\\|") : safe}\``;
+    }
     case "link":
-      return `[${renderInlineChildren(node.children)}](${node.href})`;
+      // Escape the href so a literal `)` in the URL can't terminate the
+      // destination early and break the link (F3).
+      return `[${renderInlineChildren(node.children, ctx)}](${escapeLinkHref(node.href)})`;
     default: {
       // Exhaustiveness guard — the IR union is closed; a new variant must be
       // handled above rather than silently dropped.
@@ -76,8 +94,8 @@ function renderInline(node: Inline): string {
   }
 }
 
-function renderInlineChildren(children: Inline[]): string {
-  return children.map(renderInline).join("");
+function renderInlineChildren(children: Inline[], ctx: InlineCtx = {}): string {
+  return children.map((child) => renderInline(child, ctx)).join("");
 }
 
 // ---------------------------------------------------------------------------
@@ -154,7 +172,7 @@ function renderList(node: ListNode): string {
 /** Render a single cell's inline content for a table (no line breaks — GFM
  *  table cells can't contain them; pipes are escaped defensively). */
 function renderTableCell(cells: TableRow["cells"][number]): string {
-  return renderInlineChildren(cells.children).replace(/\n+/g, " ");
+  return renderInlineChildren(cells.children, { inTableCell: true }).replace(/\n+/g, " ");
 }
 
 function alignSeparator(align: TableNode["align"][number]): string {

package/telegram-plugin/render/rich-render.ts

@@ -1,21 +1,24 @@
-// Flag-gated wiring for the Bot API 10.1 rich renderer (parse.ts + render.ts)
-// into the live outbound send path.
+// Wiring for the Bot API 10.1 rich renderer (parse.ts + render.ts) into the
+// live outbound send path.
 //
 // The renderer (`render/render.ts`, PR #2930) and parser (`render/parse.ts`)
 // have full unit coverage but were, until this module, wired into NOTHING —
-// no outbound message ever flowed through them. This module is the single,
-// feature-flagged bridge: the gateway's rich send path (stream-controller.ts)
-// runs the assistant's raw markdown through `parse → renderSafe` before it
-// reaches `sendRichMessage`, but ONLY when the flag is on.
+// no outbound message ever flowed through them. This module is the single
+// bridge: the gateway's rich send path (stream-controller.ts) runs the
+// assistant's raw markdown through `parse → renderSafe` before it reaches
+// `sendRichMessage`, unless the escape hatch below disables it.
 //
-// Feature flag — `SWITCHROOM_RICH_RENDER`, default OFF:
-//   Mirrors the `SWITCHROOM_VISIBLE_ANSWER_STREAM` convention
-//   (`answer-stream-flag.ts`): an env var read at runtime, default off, opted
-//   in PER AGENT via the `env:` block in `switchroom.yaml` (propagated into
-//   the container `environment:` by `src/agents/compose.ts`). When off,
-//   `maybeRenderOutbound` returns the input untouched, so the live send path
-//   is byte-for-byte unchanged — no agent's behaviour moves until an operator
-//   explicitly flips the flag for a specific agent. Accepts `1/true/on/yes`.
+// Escape hatch — `SWITCHROOM_RICH_RENDER`, default ON:
+//   ON BY DEFAULT in every install — an escape hatch, not an opt-in feature,
+//   mirroring the send gate's convention (`sendGateEnabledFromEnv` in
+//   `send-gate.ts`, default-on since #3153; also `midTurnFloorEnabled`,
+//   `SWITCHROOM_RATE_LIMIT_OVERAGE=0`). Enabled unless the var is explicitly
+//   set to a falsey/off value (`0`/`false`/`off`/`no`, case-insensitive,
+//   trimmed) — per agent via the `env:` block in `switchroom.yaml`
+//   (propagated into the container `environment:` by
+//   `src/agents/compose.ts`). When disabled, `maybeRenderOutbound` returns
+//   the input untouched, so the live send path is byte-for-byte the
+//   pre-renderer behaviour (raw transcript markdown to `sendRichMessage`).
 //
 // Why route through `renderSafe` and not bare `render`:
 //   `renderSafe` guarantees the returned body is never a rich-markdown string
@@ -38,17 +41,19 @@ import { RICH_MESSAGE_MAX_CHARS, splitMarkdownChunks } from "../format.js";
  */
 export const PLAIN_TEXT_MAX_CHARS = 4096;
 
-/** Parse the `SWITCHROOM_RICH_RENDER` flag value. Default OFF; accepts the
- *  same truthy tokens as the other switchroom env flags. Pure so the default
- *  + parsing are unit-testable. */
+/** Parse the `SWITCHROOM_RICH_RENDER` kill-switch value. Default ON; disabled
+ *  only by an explicit falsey/off token (`0`/`false`/`off`/`no`,
+ *  case-insensitive, trimmed) — the same disable vocabulary as
+ *  `sendGateEnabledFromEnv`. Unset, empty, or unrecognised values → ON. Pure
+ *  so the default + parsing are unit-testable. */
 export function parseRichRenderEnabled(raw: string | undefined): boolean {
-  if (raw == null) return false;
+  if (raw == null) return true;
   const v = raw.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "on" || v === "yes";
+  return !(v === "0" || v === "false" || v === "off" || v === "no");
 }
 
 /** Is the rich renderer enabled in this process? Reads the env flag live so a
- *  test can set/unset it per-case; defaults OFF. */
+ *  test can set/unset it per-case; defaults ON (escape hatch, not opt-in). */
 export function richRenderEnabled(
   env: NodeJS.ProcessEnv = process.env,
 ): boolean {
@@ -65,13 +70,14 @@ export function renderOutbound(
 }
 
 /**
- * Flag-gated transform for the live send path.
+ * Kill-switch-gated transform for the live send path.
  *
- *   - flag OFF (default): returns the input untouched, `mode: "markdown"` —
- *     identical to the pre-existing behaviour (raw transcript markdown sent
- *     straight to `sendRichMessage`). No behavioural change for any agent.
- *   - flag ON: returns `parse → renderSafe` output. `mode: "plain"` signals
- *     the caller to send WITHOUT the rich wrapper (oversized/unsafe content).
+ *   - enabled (default): returns `parse → renderSafe` output. `mode: "plain"`
+ *     signals the caller to send WITHOUT the rich wrapper (oversized/unsafe
+ *     content).
+ *   - disabled (`SWITCHROOM_RICH_RENDER=0`): returns the input untouched,
+ *     `mode: "markdown"` — identical to the pre-renderer behaviour (raw
+ *     transcript markdown sent straight to `sendRichMessage`).
  */
 export function maybeRenderOutbound(
   text: string,
@@ -83,7 +89,7 @@ export function maybeRenderOutbound(
 }
 
 /**
- * Flag-gated, CAP-ENFORCING transform for the live send path.
+ * Kill-switch-gated, CAP-ENFORCING transform for the live send path.
  *
  * `maybeRenderOutbound` returns ONE `RenderResult` and can only ever fit a
  * body into a single wire message. But `renderSafe`'s markdown re-escaping
@@ -104,11 +110,13 @@ export function maybeRenderOutbound(
  * plain degradation would have thrown away: the smaller pieces individually
  * escape under `maxLen` and come back as `markdown`.
  *
- *   - flag OFF (default): `[{ text, mode: "markdown", degradations: [] }]` —
- *     a single passthrough piece, identical to `maybeRenderOutbound`.
- *   - flag ON, body fits: `[renderSafe(...)]` — a single piece, identical to
- *     `maybeRenderOutbound` (byte-for-byte for the common case).
- *   - flag ON, body oversize: 2+ cap-respecting pieces in send order.
+ *   - disabled (`SWITCHROOM_RICH_RENDER=0`):
+ *     `[{ text, mode: "markdown", degradations: [] }]` — a single passthrough
+ *     piece, identical to `maybeRenderOutbound`.
+ *   - enabled (default), body fits: `[renderSafe(...)]` — a single piece,
+ *     identical to `maybeRenderOutbound` (byte-for-byte for the common case).
+ *   - enabled (default), body oversize: 2+ cap-respecting pieces in send
+ *     order.
  */
 export function renderOutboundChunks(
   text: string,

package/telegram-plugin/scoped-approval.ts

@@ -307,9 +307,18 @@ export function isDestructiveBashCommand(command: string): boolean {
   if (/\b(chmod|chown|chgrp)\b[^|;&]*(\s-(-recursive|[a-z]*r[a-z]*)\b)/.test(c)) return true;
   // redirection clobbering devices or system dirs
   if (/>\s*\/(dev|etc|boot|sys|proc)\b/.test(c)) return true;
-  // destructive git
+  // destructive git — discards or rewrites history / working-tree state.
+  //   checkout: `-f`/`--force` (force-overwrite), `git checkout .` / `./`
+  //     / `./<path>` (path-restore of the whole tree or a subtree) and
+  //     `checkout … -- <path>` all discard uncommitted work. A plain
+  //     `git checkout <branch>` (branch switch, reversible) is deliberately
+  //     NOT flagged. NOTE: a bare single-path discard without `--`
+  //     (`git checkout src/x.ts`) is syntactically ambiguous with a branch
+  //     name and is a known uncaught form — not full coverage.
+  //   stash: `drop`/`clear`/`pop` remove stash state irreversibly
+  //     (`stash`/`list`/`show`/`apply` keep it and stay unflagged).
   if (/\bgit\b/.test(c) &&
-      /(push\b[^|;&]*(--force|-f\b|--force-with-lease)|push\s+[^\s]*\s+\+|reset\s+--hard|clean\s+-[a-z]*[fd]|filter-branch|reflog\s+expire|update-ref\s+-d|branch\s+-d{1,2}\b|checkout\s+--\s|restore\b)/.test(c)) return true;
+      /(push\b[^|;&]*(--force|-f\b|--force-with-lease)|push\s+[^\s]*\s+\+|reset\s+--hard|clean\s+-[a-z]*[fd]|filter-branch|reflog\s+expire|update-ref\s+-d|branch\s+-d{1,2}\b|checkout\b[^|;&]*(\s-f\b|\s--force\b|\s--(\s|$)|\s\.(\s|$|\/))|stash\s+(drop|clear|pop)\b|restore\b)/.test(c)) return true;
   // power / process control
   if (/(^|\s|;|&&|\|\||\()(shutdown|reboot|halt|poweroff|kill|killall|pkill)\b/.test(c)) return true;
   if (/(^|\s)init\s+0\b/.test(c)) return true;

package/telegram-plugin/secret-detect/chunker.ts

@@ -1,13 +1,21 @@
 /**
  * Sliding-window chunker for ReDoS-bounded detection.
  *
- * Inputs larger than 32 KB are split into 16 KB windows with 1 KB overlap.
+ * Inputs larger than 32 KB are split into 16 KB windows with 8 KB overlap.
  * Each window is scanned independently; the caller is responsible for
  * dedupe-by-byte-offset when merging per-window hits back together.
  *
  * The overlap exists so a secret that straddles a window boundary is still
- * matched by at least one scan (provided the secret is ≤ 1 KB, which covers
- * every known token format plus typical PEM private keys).
+ * fully contained in at least one scan. The guarantee is exact: a secret is
+ * only missed if its length EXCEEDS the overlap (if length ≤ OVERLAP, a
+ * boundary-straddling secret is wholly inside the next window, which starts
+ * OVERLAP bytes before the boundary). The old 1 KB overlap was smaller than
+ * a real PEM private key — a 4096-bit RSA key in PEM armor is ~3.2 KB, so a
+ * boundary-straddling RSA key in a >32 KB payload slipped through unmasked
+ * (2026-07 secret-scrub review, tp-support F2). At 8 KB the overlap clears
+ * a 4096-bit RSA PEM (~3.2 KB) with >2x margin and also covers larger EC /
+ * certificate blobs. Cost: windows advance by WINDOW_SIZE−OVERLAP = 8 KB,
+ * so a big payload is scanned in ~2x as many windows — bounded and cheap.
  */
 
 export interface Window {
@@ -19,7 +27,13 @@ export interface Window {
 
 export const CHUNK_THRESHOLD = 32 * 1024
 export const WINDOW_SIZE = 16 * 1024
-export const OVERLAP = 1024
+/**
+ * 8 KB. MUST be ≥ the largest secret we need to catch across a window
+ * boundary; a 4096-bit RSA private key in PEM armor is ~3.2 KB, so this
+ * clears it with >2x headroom. See the module header for the exact
+ * "missed only if secret length > OVERLAP" guarantee.
+ */
+export const OVERLAP = 8 * 1024
 
 export function chunk(text: string): Window[] {
   if (text.length <= CHUNK_THRESHOLD) {

package/telegram-plugin/secret-detect/index.ts

@@ -11,17 +11,23 @@
  *      PEM blocks, CLI flags)
  *   3. KEY=VALUE heuristic with Shannon-entropy gate (≥ 4.0)
  *
- * Big inputs (>32 KB) are chunked into 16 KB windows with 1 KB overlap
- * (chunker.ts) for ReDoS bounding; we dedupe by byte-offset after.
+ * Big inputs (>32 KB) are chunked into 16 KB windows with 8 KB overlap
+ * (chunker.ts) for ReDoS bounding; we dedupe by byte-offset after. The
+ * overlap must exceed the largest single secret (an 8192-bit RSA PEM is
+ * ~6.5 KB) so a boundary-straddling key is never split across windows.
  *
  * Nearby test/mock/example/fixture/dummy markers (within 40 chars) demote
  * a hit to `suppressed: true`. The caller decides what that means (our
  * convention: suppressed high-confidence → ambiguous, user is asked).
  *
- * Secretlint is integrated as an async supplementary source via
- * `detectSecretsAsync`. The sync `detectSecrets` keeps the fast vendored-
- * pattern path for callers on the hot path (Telegram message ingest).
- * Gitleaks TOML is loaded via `gitleaks-loader.ts`.
+ * Detection is vendored-patterns-only and synchronous: every live caller
+ * (inbound gate, outbound scrub, `redact.ts`, `pipeline.ts`) runs
+ * `detectSecrets`. There is deliberately NO Secretlint/async "safety net"
+ * layered underneath — an earlier `detectSecretsAsync` + Secretlint wrapper
+ * was never wired into any live path (test-only), so it was a false safety
+ * net and has been removed (2026-07 secret-scrub review, tp-support F1).
+ * Arming a new async scanner belongs in its own validated change, not the
+ * scrub-coverage PR. Gitleaks TOML is loaded via `gitleaks-loader.ts`.
  */
 import { ALL_PATTERNS } from './patterns.js'
 import { scanKeyValue, type RawHit } from './kv-scanner.js'
@@ -209,53 +215,3 @@ function dropOverlaps(hits: RawHit[]): RawHit[] {
 export { maskToken } from './mask.js'
 export { redactUrls } from './url-redact.js'
 export { deriveSlug } from './slug.js'
-export { detectViaSecretlint } from './secretlint-source.js'
-
-/**
- * Async detection pipeline — runs `detectSecrets` (fast vendored engine)
- * and Secretlint in parallel, then merges the results by deduping on
- * `[start, end)` byte ranges. If Secretlint and a vendored pattern both
- * match the same span, the first one wins (vendored, since it's listed
- * first in the merge array below).
- *
- * Slug collisions are re-resolved on the merged list so the overall
- * output has unique `suggested_slug` values.
- */
-export async function detectSecretsAsync(text: string): Promise<Detection[]> {
-  if (!text || text.length === 0) return []
-  const [vendored, viaSecretlint] = await Promise.all([
-    Promise.resolve(detectSecrets(text)),
-    // Lazy-import keeps the sync `detectSecrets` path free of Secretlint
-    // initialization cost; paid once on first async call.
-    import('./secretlint-source.js').then((m) => m.detectViaSecretlint(text)),
-  ])
-
-  // Merge with range-based dedupe. On an exact-range tie, prefer the
-  // higher-confidence detection (else vendored-first). This matters since
-  // the vendored generic high-entropy fallback emits `ambiguous` — without
-  // the confidence tie-break it would shadow a Secretlint `high` provider
-  // hit on the same span and silently downgrade it (mirrors the sync
-  // dedupeRaw's high-over-ambiguous rule).
-  const seen = new Map<string, Detection>()
-  const consider = (d: Detection): void => {
-    const key = `${d.start}:${d.end}`
-    const existing = seen.get(key)
-    if (!existing || (existing.confidence === 'ambiguous' && d.confidence === 'high')) {
-      seen.set(key, d)
-    }
-  }
-  for (const d of vendored) consider(d)
-  for (const d of viaSecretlint) consider(d)
-
-  // Re-derive slugs against the merged set (Secretlint and vendored each
-  // had independent `existing` sets; we coalesce here).
-  const existing = new Set<string>()
-  const out: Detection[] = Array.from(seen.values())
-    .sort((a, b) => a.start - b.start)
-    .map((d) => {
-      const slug = deriveSlug({ key_name: d.key_name, rule_id: d.rule_id }, existing)
-      existing.add(slug)
-      return { ...d, suggested_slug: slug }
-    })
-  return out
-}

package/telegram-plugin/send-gate-degraded.test.ts

@@ -405,6 +405,137 @@ describe('send-gate PR2: M2 critical wait re-evaluates the window each iteration
   })
 })
 
+describe('send-gate F4: a CRITICAL edit honours the fail-fast ceiling (no unbounded block)', () => {
+  it('fails fast with a structured FLOOD_WAIT_ACTIVE instead of blocking unbounded on the edit driver', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // 10-minute ban >> the 60s ceiling. On the pre-fix edit path this window
+      // routed a `critical` card edit through the driver's UNBOUNDED admit and
+      // blocked for the whole ban; the fix must fail fast like the non-edit path.
+      initialWindows: [{ scopeKey: 'global', untilTs: 600_000 }],
+    })
+
+    let caught: unknown
+    try {
+      // messageId + editPayload → edit path; priorityClass:'critical' is the case
+      // handleEdit previously ignored (only 'cosmetic' was special-cased).
+      await gate.gate(fn('critical-edit'), {
+        messageId: 42,
+        editPayload: 'v1',
+        priorityClass: 'critical',
+      })
+    } catch (err) {
+      caught = err
+    }
+
+    // Fail fast (structured flood-wait), NOT an unbounded block that never
+    // settles — the multi-hour reply wedge the send-gate exists to eliminate.
+    expect(isFloodWaitActiveError(caught)).toBe(true)
+    const e = caught as { untilTs: number; retryAfterSec: number; error_code: number }
+    expect(e.error_code).toBe(429)
+    expect(e.untilTs).toBe(600_000)
+    expect(e.retryAfterSec).toBe(600)
+    expect(calls).toHaveLength(0) // never probed the API
+    expect(gate.stats().global.failedFast).toBe(1)
+    expect(gate.stats().global.sent).toBe(0)
+  })
+
+  it('waits out a SHORT window (<= ceiling) then sends the critical edit — mirrors the non-edit path', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // 30s window, under the 60s ceiling → the critical edit waits it out and
+      // then sends (not shed, not failed fast).
+      initialWindows: [{ scopeKey: 'global', untilTs: 30_000 }],
+    })
+
+    const p = gate.gate(fn('critical-edit'), {
+      messageId: 7,
+      editPayload: 'v1',
+      priorityClass: 'critical',
+    })
+    await clock.advance(31_000)
+    const res = await p
+
+    expect(res).toBe('critical-edit')
+    expect(calls).toHaveLength(1)
+    expect(calls[0]!.at).toBeGreaterThanOrEqual(30_000)
+    expect(gate.stats().global.failedFast).toBe(0)
+    expect(gate.stats().global.sent).toBe(1)
+  })
+})
+
+describe('send-gate F2: a CRITICAL edit coalescing onto a non-critical driver still fail-fasts', () => {
+  it('a critical edit that coalesces onto a running useful driver rejects FLOOD_WAIT_ACTIVE (does NOT ride the unbounded admit)', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // Large edit floor so a queued useful edit SITS in the driver's floor
+      // sleep long enough for a later critical edit to coalesce onto it BEFORE
+      // the driver dequeues — the exact race the fix closes.
+      editFloorMs: 10_000,
+    })
+
+    // 1. Warm the message so its edit floor is armed (a cold message would fire
+    //    the first edit at t=0 with no floor sleep, leaving no window to coalesce
+    //    into). This send happens BEFORE any ban.
+    const pWarm = gate.gate(fn('warm'), { messageId: 42, editPayload: 'warm' })
+    await flush()
+    await pWarm
+    expect(calls.map((c) => c.label)).toEqual(['warm'])
+
+    // 2. A 10-minute flood ban (>> the 60s ceiling) opens on the global scope.
+    gate.openFloodWindow('global', 600_000)
+
+    // 3. A USEFUL edit to the same message starts the driver and enters the
+    //    floor sleep (floor not yet cleared). It is NOT critical, so the
+    //    driver-start opts capture priorityClass='useful'.
+    const pUseful = gate
+      .gate(fn('useful'), { messageId: 42, editPayload: 'u', priorityClass: 'useful' })
+      .catch((e) => e)
+    await flush()
+
+    // 4. A CRITICAL edit to the SAME message arrives mid-ban and COALESCES onto
+    //    the pending useful edit (shared promise). With the driver-start-opts
+    //    bug this critical work rode the unbounded admit and blocked for the
+    //    whole 10-minute ban; the fix upgrades the pending edit's priority so
+    //    the driver reads `critical` and fails fast.
+    const pCritical = gate
+      .gate(fn('critical'), { messageId: 42, editPayload: 'c', priorityClass: 'critical' })
+      .catch((e) => e)
+    await flush()
+
+    // 5. Walk PAST the edit floor but NOT past the ban. On the fixed code the
+    //    driver wakes, sees the coalesced critical class, and fails fast.
+    await clock.advance(10_001)
+
+    const caughtCritical = await pCritical
+    const caughtUseful = await pUseful
+
+    // The coalesced (shared) promise rejects with a structured flood-wait —
+    // it did NOT block unbounded for the remaining ~10 minutes of the ban.
+    expect(isFloodWaitActiveError(caughtCritical)).toBe(true)
+    expect(isFloodWaitActiveError(caughtUseful)).toBe(true)
+    const e = caughtCritical as { untilTs: number; retryAfterSec: number; error_code: number }
+    expect(e.error_code).toBe(429)
+    expect(e.untilTs).toBe(600_000)
+    // Only the warm edit ever probed the API; the coalesced edit never did.
+    expect(calls.map((c) => c.label)).toEqual(['warm'])
+    expect(gate.stats().global.failedFast).toBe(1)
+    expect(gate.stats().global.sent).toBe(1)
+  })
+})
+
 describe('send-gate PR2: opening a window from a 429, and persistence hook', () => {
   it('opens scope windows via onWindowOpen when a non-edit send throws FLOOD_WAIT_ACTIVE', async () => {
     const clock = new FakeClock()

package/telegram-plugin/send-gate.test.ts

@@ -87,15 +87,34 @@ describe('send-gate: feature flag', () => {
     expect(calls.map((c) => c.label)).toEqual(['v1', 'v2'])
   })
 
-  it('sendGateEnabledFromEnv follows the SWITCHROOM_*=== "1" convention', () => {
-    expect(sendGateEnabledFromEnv({} as NodeJS.ProcessEnv)).toBe(false)
+  it('sendGateEnabledFromEnv is ON BY DEFAULT (escape hatch, not opt-in)', () => {
+    // Unset → enabled. This assertion is load-bearing: it fails if the default
+    // is ever flipped back to off.
+    expect(sendGateEnabledFromEnv({} as NodeJS.ProcessEnv)).toBe(true)
     expect(
-      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: '0' } as unknown as NodeJS.ProcessEnv),
-    ).toBe(false)
-    expect(
-      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: '1' } as unknown as NodeJS.ProcessEnv),
+      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: undefined } as NodeJS.ProcessEnv),
     ).toBe(true)
   })
+
+  it('sendGateEnabledFromEnv disables only on explicit off values (safety valve)', () => {
+    for (const off of ['0', 'false', 'off', 'no', 'FALSE', 'Off', ' no ', '  0 ']) {
+      expect(
+        sendGateEnabledFromEnv({
+          SWITCHROOM_TELEGRAM_SEND_GATE: off,
+        } as unknown as NodeJS.ProcessEnv),
+      ).toBe(false)
+    }
+  })
+
+  it('sendGateEnabledFromEnv stays enabled for any other value', () => {
+    for (const on of ['1', 'true', 'on', 'yes', 'enabled', '', 'anything']) {
+      expect(
+        sendGateEnabledFromEnv({
+          SWITCHROOM_TELEGRAM_SEND_GATE: on,
+        } as unknown as NodeJS.ProcessEnv),
+      ).toBe(true)
+    }
+  })
 })
 
 describe('send-gate: global bucket', () => {